.NET Reactor 混淆 C# 的序列化和反序列化存在的问题

1、使用二进制格式化器进行序列化和反序列化
- 1.1、定义可序列化对象
- 1.2、使用对象的序列化和反序列化保存和读取配置文件
- [1.3、使用 .NET Reactor 混淆程序后，无法读取配置](#1.3、使用 .NET Reactor 混淆程序后，无法读取配置)
[2、改用 XML 进行序列化和反序列化避免混淆出错](#2、改用 XML 进行序列化和反序列化避免混淆出错)
- 2.1、定义对象
- [2.2、使用 XML 序列化和反序列化保存和读取配置文件](#2.2、使用 XML 序列化和反序列化保存和读取配置文件)
- [2.3、使用 .NET Reactor 混淆程序后，读取程序配置正常](#2.3、使用 .NET Reactor 混淆程序后，读取程序配置正常)

1、使用二进制格式化器进行序列化和反序列化

1.1、定义可序列化对象

csharp 复制代码

[Serializable]  // 对象可序列化标记
 public class AppConfig
{
            /// <summary>程序开发者</summary>
            public string RLStudio { get; set; } = "雨水工作室";
            /// <summary>ADCP项目MMT文件</summary>
            public string AdcpMmtPathFile { get; set; } = Environment.CurrentDirectory;
            /// <summary>ADCP项目目录</summary>
            public string AdcpProjectPath { get; set; } = Environment.CurrentDirectory;
            /// <summary>长江航道局水位数据文件</summary>
            public string CJHDJDataPathFile { get; set; } = Environment.CurrentDirectory;
            /// <summary>Hypack 数据文件</summary>
            public string HypackPathFile { get; set; } = Environment.CurrentDirectory;
            /// <summary>YAC9900 SD卡数据文件</summary>
            public string YAC9900SdPathFile { get; set; } = Environment.CurrentDirectory;
            /// <summary>RTK 数据文件</summary>
            public string RtkDataPathFile { get; set; } = Environment.CurrentDirectory;
            //省略......
}

1.2、使用对象的序列化和反序列化保存和读取配置文件

csharp 复制代码

using System.Runtime.Serialization.Formatters.Binary;
partial class HypackDataProce : Form
{   
        AppConfig appConfig = new AppConfig();
        private void HypackDataProce_Load(object sender, EventArgs e)
        {
            string ConfigFile = Application.StartupPath + "\\config.cfg";

            if (File.Exists(ConfigFile))
            {
                try
                {
                    //创建二进制格式化器
                    BinaryFormatter formatter = new BinaryFormatter();

                    //创建文件流
                    using (FileStream fs = new FileStream(ConfigFile, FileMode.Open, FileAccess.Read, FileShare.Read))
                    {
                       appConfig = (AppConfig)formatter.Deserialize(fs);//调用序列化方法，获取配置
                    }
                }
                catch
                {
                }
            }
        }

       public void SaveAppConfig()
        {
            try
            {
               string ConfigFile = Application.StartupPath + "\\config.cfg";
               //创建二进制格式化器
               BinaryFormatter formatter = new BinaryFormatter();
               //创建文件流
               using (FileStream fs = new FileStream(ConfigFile, FileMode.Create, FileAccess.ReadWrite, FileShare.ReadWrite))
               {
                    formatter.Serialize(fs, appConfig);  //调用序列化方法，保存配置
               }
            }
            catch
            {
            }
        }
}

1.3、使用 .NET Reactor 混淆程序后，无法读取配置

没有混淆的程序，运行没有任何错误，使用 .NET Reactor 混淆程序后，无法读取配置，查看配置文件，与不混淆保存的配置文件存在很大的差别。

没有混淆时的配置文件，使用文本打开:

bash 复制代码

              FHypackDataProce, Version=2.0.0.0, Culture=neutral, PublicKeyToken=null   )HypackDataProce.UserPublicClass+AppConfig   <RLStudio>k__BackingField <AdcpMmtPathFile>k__BackingField <AdcpProjectPath>k__BackingField"<CJHDJDataPathFile>k__BackingField<HypackPathFile>k__BackingField"<YAC9900SdPathFile>k__BackingField <RtkDataPathFile>k__BackingField(<MeasureParamMenuChecked>k__BackingField(<MeasurePlaneMenuChecked>k__BackingField,<MeasureDataSheetMenuChecked>k__BackingField*<MeasureProfileMenuChecked>k__BackingField"<MeasureParamWidth>k__BackingField#<MeasureParamHeight>k__BackingField!<MeasureParamLeft>k__BackingField <MeasureParamTop>k__BackingField&<MeasureDataSheetWidth>k__BackingField'<MeasureDataSheetHeight>k__BackingField%<MeasureDataSheetLeft>k__BackingField$<MeasureDataSheetTop>k__BackingField"<MeasurePlaneWidth>k__BackingField#<MeasurePlaneHeight>k__BackingField!<MeasurePlaneLeft>k__BackingField <MeasurePlaneTop>k__BackingField$<MeasureProfileWidth>k__BackingField%<MeasureProfileHeight>k__BackingField#<MeasureProfileLeft>k__BackingField"<MeasureProfileTop>k__BackingField                          闆ㄦ按宸ヤ綔瀹?   &F:\Source Code\HydroDatPro\bin\Release   &F:\Source Code\HydroDatPro\bin\Release   &F:\Source Code\HydroDatPro\bin\Release    8E:\2024澶ф柇闈鍗楀拃20240311\鍗楀拃涓柇闈0003.RAW   &F:\Source Code\HydroDatPro\bin\Release	   &F:\Source Code\HydroDatPro\bin\Release?         ?   4  ?  ~      ?  ?  ?      ?  ?  ?   h

可以发现 PublicKeyToken=null ，HypackDataProce.UserPublicClass+AppConfig ，混淆后保存的配置文件，这 2 项内容也被混淆，可见 .NET Reactor 对二进制格式化器 BinaryFormatter 的序列化和反序列化存在漏洞。

C# 2017 net.framework 框架下，谁有二进制序列化和反序列化更好的方法呢？

2、改用 XML 进行序列化和反序列化避免混淆出错

2.1、定义对象

csharp 复制代码

 public class AppConfig
{
            /// <summary>程序开发者</summary>
            public string RLStudio { get; set; } = "雨水工作室";
            /// <summary>ADCP项目MMT文件</summary>
            public string AdcpMmtPathFile { get; set; } = Environment.CurrentDirectory;
            /// <summary>ADCP项目目录</summary>
            public string AdcpProjectPath { get; set; } = Environment.CurrentDirectory;
            /// <summary>长江航道局水位数据文件</summary>
            public string CJHDJDataPathFile { get; set; } = Environment.CurrentDirectory;
            /// <summary>Hypack 数据文件</summary>
            public string HypackPathFile { get; set; } = Environment.CurrentDirectory;
            /// <summary>YAC9900 SD卡数据文件</summary>
            public string YAC9900SdPathFile { get; set; } = Environment.CurrentDirectory;
            /// <summary>RTK 数据文件</summary>
            public string RtkDataPathFile { get; set; } = Environment.CurrentDirectory;
            //省略......
}

2.2、使用 XML 序列化和反序列化保存和读取配置文件

csharp 复制代码

using System.Xml.Serialization;
partial class HypackDataProce : Form
{   
        AppConfig appConfig = new AppConfig();
        private void HypackDataProce_Load(object sender, EventArgs e)
        {
            string ConfigFile = Application.StartupPath + "\\config.cfg";

            if (File.Exists(ConfigFile))
            {
                try
                {
                    XmlSerializer serializer = new XmlSerializer(typeof(AppConfig));// 创建XmlSerializer实例，指定要反序列化的类型
                    using (FileStream fileStream = new FileStream(ConfigFile, FileMode.Open))
                    {
                        appConfig = (AppConfig)serializer.Deserialize(fileStream);// 反序列化 XML 到 AppConfig 对象
                    }
                }
                catch
                {
                }
            }
        }

       public void SaveAppConfig()
       {
            try
            {
               string ConfigFile = Application.StartupPath + "\\config.cfg";
               
               XmlSerializer serializer = new XmlSerializer(typeof(AppConfig));// 创建XmlSerializer实例，指定要反序列化的类型
               using (TextWriter writer = new StreamWriter(ConfigFile))
              {
                serializer.Serialize(writer, appConfig);
              }
           }
           catch
           {
           }
     }
}

2.3、使用 .NET Reactor 混淆程序后，读取程序配置正常

bash 复制代码

<?xml version="1.0" encoding="utf-8"?>
<AppConfig xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <RLStudio>雨水工作室</RLStudio>
  <AdcpMmtPathFile>F:\Source Code\HydroDatPro\bin\Release</AdcpMmtPathFile>
  <AdcpProjectPath>F:\Source Code\HydroDatPro\bin\Release</AdcpProjectPath>
  <CJHDJDataPathFile>F:\Source Code\HydroDatPro\bin\Release</CJHDJDataPathFile>
  <HypackPathFile>F:\Source Code\HydroDatPro\bin\Release</HypackPathFile>
  <YAC9900SdPathFile>F:\Source Code\HydroDatPro\bin\Release</YAC9900SdPathFile>
  <RtkDataPathFile>F:\Source Code\HydroDatPro\bin\Release</RtkDataPathFile>
  <MeasureParamMenuChecked>true</MeasureParamMenuChecked>
  <MeasurePlaneMenuChecked>true</MeasurePlaneMenuChecked>
  <MeasureDataSheetMenuChecked>true</MeasureDataSheetMenuChecked>
  <MeasureProfileMenuChecked>true</MeasureProfileMenuChecked>
  <MeasureParamWidth>216</MeasureParamWidth>
  <MeasureParamHeight>793</MeasureParamHeight>
  <MeasureParamLeft>0</MeasureParamLeft>
  <MeasureParamTop>180</MeasureParamTop>
  <MeasureDataSheetWidth>564</MeasureDataSheetWidth>
  <MeasureDataSheetHeight>1022</MeasureDataSheetHeight>
  <MeasureDataSheetLeft>1150</MeasureDataSheetLeft>
  <MeasureDataSheetTop>0</MeasureDataSheetTop>
  <MeasurePlaneWidth>436</MeasurePlaneWidth>
  <MeasurePlaneHeight>367</MeasurePlaneHeight>
  <MeasurePlaneLeft>483</MeasurePlaneLeft>
  <MeasurePlaneTop>0</MeasurePlaneTop>
  <MeasureProfileWidth>959</MeasureProfileWidth>
  <MeasureProfileHeight>662</MeasureProfileHeight>
  <MeasureProfileLeft>206</MeasureProfileLeft>
  <MeasureProfileTop>360</MeasureProfileTop>
</AppConfig>